Re:Two guys hated using Comcast, so they built their own fib...
by eythian on Tuesday July 15, 2025 @10:46AM
(#44571685)
My feeling with privacy extensions is that it's more to prevent enumeration of a network by looking at outgoing traffic. It may have a degree of tracking protection too, but that's probably less important, and is about equivalent to everything being behind a single NAT address.
Re:Two guys hated using Comcast, so they built their own fib...
by simoncion on Wednesday July 16, 2025 @06:25PM
(#44587483)
The RFC 4941 problem statement [0] notes that an attacker who can look at outgoing traffic from a network will not be thwarted by "privacy" addresses. The background section of that document goes on to say that "privacy" addresses do little-to-nothing to thwart correlation attempts against client networks that have few hosts on them.
IMO, something like what's described in RFC 7217 [1] (changing the interface identifier used for "permanent" addresses from the interface's MAC address to something that mixes in the advertised prefix) is a much better way to address the concerns described in section 2.3 of RFC 4941.
[0] <https://datatracker.ietf.org/doc/html/rfc4941#section-1.2>
[1] <https://datatracker.ietf.org/doc/html/rfc7217#section-4>
Another feature that I find to be pretty stupid (but that some folks seem to really like) are IPv6 "privacy" addresses. Because each host usually is assigned an IPv6 address in a subnet that's 64 bits wide, most mainstream OS's have configured their IPv6 address autoconfigurator to set one stable, "permanent" address, and to set a parade of periodically changing "temporary" addresses. The OS is usually configured to prefer the permanent address when software asks for a socket to listen on (and sockets that handle replies to that listen socket), and those temporary addresses are preferred for sockets that initiate outbound traffic. The idea is that this is supposed to confuse tracking, but I'm very skeptical of its efficacy in the real world.
Finally, a customer can also usually get enough IP space to make globally-reachable subnets on their LAN. Depending how the ISP has configured things, a customer can get between four and 256 subnets. These subnets are handy to provide networks that provide globally-reachable IP addresses, but that can be easily logically isolated from the rest of the LAN by the router.